Skip to content

Instantly share code, notes, and snippets.

@weirded
Created January 8, 2015 23:45
Show Gist options
  • Save weirded/4dbfd64e66be9de01f43 to your computer and use it in GitHub Desktop.
Save weirded/4dbfd64e66be9de01f43 to your computer and use it in GitHub Desktop.
Query 1
error
| parse “ip=*, errorcode=*“ as ip, errorcode
| lookup ip from /my/whitelisted_ips on ip=ip
| where errorcode=”failed_login”
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment